Privacy policy

This English version is provided for your convenience. Only the German version is legally binding.

Last updated: 20 October 2026

This privacy policy informs you about which personal data we process when you visit hustleandpain.com, order from us or write to us, why we do so and what rights you have. Personal data is any information by which you can be personally identified, for example your name, your email address or your IP address.

1. Controller

The controller responsible for data processing on this website is:

HUSTLE&PAIN
Alexander Klenner
Johannesstr. 72
70176 Stuttgart
Germany
Email: info@hustleandpain.com

We are not required to appoint a data protection officer under Art. 37 GDPR (DSGVO) and § 38 BDSG. If you have any questions about data protection, please write to us at the email address given above.

2. The key points in brief

  • Our shop runs on Shopify. For orders, payment and shipping, we only pass on the data that is necessary for these purposes.
  • Analytics and advertising services (Google, Meta, Microsoft) and the analysis by Klaviyo on the website only run if you click “Accept” in the cookie banner. If you choose “Decline”, they remain switched off.
  • You will only receive newsletters and email notifications if you sign up for them. You can unsubscribe at any time.
  • Among other things, you have the right of access, rectification, erasure and objection (Section 15).

3. Legal bases

We only process personal data if one of the following legal bases of the General Data Protection Regulation (GDPR) applies:

  • Consent (Art. 6(1)(a) GDPR), for example for newsletters, analytics and advertising. Where we store or read information on your device for this purpose, such as cookies, § 25(1) TDDDG is an additional legal basis.
  • Contract (Art. 6(1)(b) GDPR), for example for orders, payment, shipping and customer accounts, including before a contract is concluded, at your request.
  • Legal obligation (Art. 6(1)(c) GDPR), for example for the retention of invoices under commercial and tax law.
  • Legitimate interest (Art. 6(1)(f) GDPR), for example for a secure and fast shop or to answer enquiries. We state our specific interest under each individual point.

Information on your device that is strictly necessary for the operation of the shop, such as for the shopping basket or your cookie choice, is stored without consent on the basis of § 25(2) no. 2 TDDDG.

4. Visiting the website, hosting and embedded content

Our shop runs on the Shopify platform (hosting, shop system and checkout). The provider for merchants in Europe is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify also processes data at Shopify Inc. in Canada and with service providers in the USA (Section 13). We have concluded a data processing agreement with Shopify in accordance with Art. 28 GDPR.

Each time our website is accessed, technically necessary data is processed: IP address, date and time, page accessed, previously visited page, browser, operating system and device type. This is necessary in order to deliver the pages to you, to find errors and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our interest is a secure and functioning shop.

So that the pages are displayed in full, your browser also loads program code, fonts and images directly from the servers of the following providers. For technical reasons, these providers receive your IP address in the process:

  • Shopify (see above)
  • Klaviyo for our email functions (Section 10)
  • Klarna and PayPal for payment information and payment buttons (Section 7)
  • Loox for customer reviews (Section 11)
  • jsDelivr, a content delivery network for program code, operated by Prospect One, Poland. We use it to load a small library for smooth scrolling. jsDelivr privacy policy

The legal basis is Art. 6(1)(f) GDPR; our interest is a fast and complete display of the shop.

Shopify as an independent controller. For some functions, such as Shop Pay, the Shop app and fraud prevention across multiple shops, Shopify processes data under its own responsibility. You can find out more in the Shopify consumer privacy policy. You can exercise your rights against Shopify via the Shopify privacy portal.

5. Cookies and cookie banner

Cookies are small text files that your browser stores. Your browser's local storage and session storage work in a similar way. We distinguish between two types:

Strictly necessary. The shop needs these entries so that the shopping basket, country, currency, checkout and your cookie choice work, for example _shopify_essential, localization, cart_currency and _shop_app_essential from Shopify. They are set without consent (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).

Analytics and marketing. These services (Section 12 and the analysis by Klaviyo in Section 10) only run once you click “Accept” in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). If you click “Decline”, they remain switched off.

Your choice. We store your decision in your browser and pass it on to the embedded services via Shopify's privacy interface. “Accept” remains stored until you withdraw your consent or delete your browser data. “Decline” applies to the current session. We will ask you again on your next visit.

Withdrawal of consent. You can withdraw your consent at any time with effect for the future. To do so, delete the website data stored for hustleandpain.com in your browser. The banner will then appear again and you can make a new choice. Any processing carried out up to that point remains lawful.

6. Orders and customer account

When you place an order, we process the information you provide at checkout: name, delivery and billing address, email address, telephone number where applicable, items ordered, payment method and order history. We need this data in order to perform the purchase contract, to send you order and shipping confirmations and to handle returns or withdrawals (Art. 6(1)(b) GDPR). Without this information, we cannot carry out your order.

Shopify automatically checks orders for signs of fraud (Art. 6(1)(f) GDPR; our interest is protection against misuse and payment defaults). Whether an order is cancelled is decided by us, not by the technology alone.

You can use a customer account. You sign in with your email address and a verification code. In your account you can see your orders and saved addresses (Art. 6(1)(b) GDPR). If you would like your account to be deleted, please send us an email.

We retain invoices and accounting records for as long as commercial and tax law require (§ 257 HGB, § 147 AO, up to ten years depending on the document). During this period, we use the data solely to fulfil this obligation (Art. 6(1)(c) GDPR). We delete the remaining order data once the contract has been fully completed and no further claims can arise.

7. Payment

Depending on the payment method you choose, we pass on the data required for the payment (name, address, email address, amount, order number) to the relevant payment service provider (Art. 6(1)(b) GDPR):

  • Shopify Payments for credit card, Apple Pay, Google Pay and Shop Pay. Your card details are processed by Shopify and its payment partners; we do not see them.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal privacy policy
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For payment methods such as invoice or instalment purchase, Klarna may check your identity and creditworthiness and is itself responsible for doing so. Klarna privacy policy

On the product pages we show a notice from Klarna about instalment payments and payment buttons such as PayPal. For this purpose, your browser loads content from these providers. In the process, your IP address and technical information about your browser are transmitted (Art. 6(1)(f) GDPR; our interest is to show you the payment methods before you buy).

8. Shipping

For delivery, we pass on your name and delivery address to our shipping service provider DHL: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn (Art. 6(1)(b) GDPR). DHL privacy policy

9. Contact

If you write to us by email or via the contact form, we process your details (name, email address, message) in order to answer your enquiry. If the enquiry relates to an order, the legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR (our interest is to answer your enquiry). We delete the enquiry once it has been dealt with and there is no obligation to retain it.

Withdrawal via our withdrawal form. You can withdraw from a purchase using the “Withdraw from contract” button at the bottom of every page. In doing so, we process your name, your email address, the order number and the scope of the withdrawal, as well as any information you provide voluntarily (order and delivery date, problems you have selected, your description, telephone number). We need this information in order to process your withdrawal and to confirm receipt to you immediately by email, as required by law (Art. 6(1)(b) and (c) GDPR in conjunction with § 356a BGB). The information is sent via Shopify by email to our mailbox. For the confirmation of receipt, we transmit your name, email address, order number, scope and items to Klaviyo (Section 10). We store the information for as long as claims arising from the purchase may exist, generally three years from the end of the year in which the withdrawal was received, and beyond that insofar as tax retention obligations apply.

Spam protection. When the contact form and the withdrawal form are submitted, Shopify uses the hCaptcha service of Intuition Machines, Inc., USA. hCaptcha uses technical characteristics such as your IP address and browser data to check whether the form is being submitted by a human. In rare cases, a small picture puzzle appears. The legal basis is Art. 6(1)(f) GDPR; our interest is protection against automated misuse. hCaptcha privacy policy

10. Emails: newsletter, back-in-stock notification and waiting list

For our emails we use Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA. We have concluded a data processing agreement with Klaviyo. Klaviyo is certified under the EU-US Data Privacy Framework (Section 13). Klaviyo privacy notice

Newsletter. If you sign up for the newsletter, we send you news about new drops, promotions and our brand. Your email address is all we need for this. As a thank you, you will receive a one-time discount code by email. In order to be able to prove your consent, we store the time of your sign-up and the form through which you signed up.

Back-in-stock notification. If a size is sold out, you can leave your email address. We will then send you an email as soon as the size is available again.

Basics waiting list. If you sign up on the “Basics” page, we will notify you by email as soon as the Basics are available.

In each case, the legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) UWG). You can unsubscribe at any time via the unsubscribe link in every email or by emailing us. We store your data until you unsubscribe. After that, we retain proof of your consent for up to three years in order to be able to defend ourselves against claims (Art. 6(1)(f) GDPR).

Klaviyo analyses whether you open our emails and which links you click. This shows us which content resonates. This analysis is part of your consent to the newsletter. If you do not want this, please unsubscribe.

Klaviyo on the website. Only if you click “Accept” in the cookie banner does Klaviyo set the cookie __kla_id and recognise which products you view. If your email address is already registered with us, this allows us to send you relevant emails, for example a reminder about a product you have viewed (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

11. Customer reviews

We display customer reviews using Loox: Loox Online Ltd., Ramat Gan, Israel. For this purpose, your browser loads reviews, photos and fonts from Loox servers on the product pages. Your IP address is transmitted in the process (Art. 6(1)(f) GDPR; our interest is to show genuine customer opinions). There is an adequacy decision of the European Commission for Israel. Loox privacy policy

After an order, we ask you by email to leave a review. The legal basis is your consent, insofar as you have given it (Art. 6(1)(a) GDPR), otherwise our legitimate interest in feedback on our products (Art. 6(1)(f) GDPR). If you do not want to receive review requests, you can object at any time via the link in the email or by emailing us. If you submit a review, we publish your first name, the initial of your surname, your review and, where applicable, your photos. You receive a discount code for a review with a photo. We will delete your review at any time on request.

12. Analytics and advertising, only with your consent

The following services only run if you have clicked “Accept” in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). They help us to understand how our shop is used and to measure our advertising and show it to suitable people. You can withdraw your consent at any time (Section 5).

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics measures which pages are visited, where visitors come from and which products are purchased. For this purpose, Google sets cookies such as _ga with a lifetime of up to two years. According to Google, the IP addresses of users from the EU are not stored. Google automatically deletes the collected data once the retention period set by us has expired.

Google Ads and Google Merchant Center

With Google Ads, we measure whether a visit or purchase can be traced back to one of our ads, and we can later show ads to visitors to our shop (remarketing). Via Google Merchant Center, our products appear in Google Search and on Google Shopping. In the process, it is measured whether visitors buy from us via these listings. In each case, the provider is Google Ireland Limited (address above). Google also processes data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Google privacy policy

Meta Pixel and Conversions API

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With the Meta Pixel, we measure whether our ads on Instagram and Facebook lead to visits and purchases, and we can show ads there to visitors to our shop. In addition, with your consent, Shopify transmits events such as a purchase directly to Meta (Conversions API). Contact details are irreversibly encrypted (hashed) beforehand. We are joint controllers with Meta for the collection of this data and its transmission to Meta (Art. 26 GDPR). The agreement on this stipulates that Meta is responsible for handling your requests regarding this data. Meta alone is responsible for any further processing. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Meta privacy policy

Microsoft Advertising

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. With the UET tag, we measure whether ads in Bing search lead to visits and purchases. For this purpose, Microsoft sets cookies such as _uetsid and _uetvid. Microsoft Corporation is certified under the EU-US Data Privacy Framework. Microsoft privacy statement

13. Recipients and transfers to countries outside the EU

We only pass on your data to the recipients named in this policy. Service providers who work on our behalf, such as Shopify and Klaviyo, are contractually bound by us in accordance with Art. 28 GDPR. Payment service providers and DHL process your data under their own responsibility. We do not sell data.

Some recipients are based outside the EU or process data there:

  • USA: For companies certified under the EU-US Data Privacy Framework, including Google, Meta, Microsoft and Klaviyo, the adequacy decision of the European Commission of 10 July 2023 applies (Art. 45 GDPR). You can check whether a company is certified in the official list. In all other cases, we agree the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).
  • Canada (Shopify Inc.) and Israel (Loox): There is an adequacy decision of the European Commission for both countries (Art. 45 GDPR).

14. How long we store data

We only store personal data for as long as is necessary for the respective purpose and delete it afterwards, unless a statutory retention obligation requires longer storage. The retention periods are stated in the individual sections. Cookies from analytics and advertising services expire after a maximum of two years, depending on the provider, unless you delete them earlier.

15. Your rights

You have the following rights with respect to us:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Receipt of your data in a commonly used format (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): If we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object to this at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the enforcement or defence of legal claims. You may object to advertising at any time without giving reasons.

To exercise your rights, please write to info@hustleandpain.com. To ensure that we do not disclose data to unauthorised persons, we may verify your identity. Exercising your rights will not result in any disadvantage to you.

Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with any data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

16. Obligation to provide data and automated decisions

For an order, we need the information marked as mandatory at checkout. All other information is voluntary. We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). For the credit check by Klarna, see Section 7.

17. Links to other websites and social networks

Our shop contains links, for example to Instagram. These are simple links. Only when you click on them are you redirected, and only then does the operator of the other site receive data from you. The operators of the linked sites are responsible for those sites.

18. Children

Our services are not aimed at children under the age of 16. We do not knowingly collect data from children. If, as a parent, you believe that your child has provided us with data, please write to us. We will then delete the data.

19. Data security

Our website is encrypted throughout (TLS, recognisable by “https” and the padlock symbol in your browser). Nobody can guarantee absolute security for transmission over the internet. For this reason, please do not send us sensitive data unencrypted.

20. Changes

We amend this privacy policy when our shop, our services or the legal situation change. The version published here, with the date stated above, applies in each case.